How it was found

The following report intends to disclose a bypass for #416983.

It's been found that removed staff members who had "Apps" permission can still modify flow app connection settings due to improper authorization.

Description

Signed URLs generated by Shopify Flow (https://apps.shopify.com/flow) use a timestamp so it remains valid only during a period of one hour.

After that period of time, a removed staff member that previously had Apps permissions should not be able to get unauthorized access to store data, or to connect and disconnect Google Sheets, Trello and Asana accounts from Flow.

With that said, it's possible for a removed staff member to keep refreshing the timestamp and path_hmac parameters again and again to get unauthorized access to Flow app connections, forever.

Steps To Reproduce:

1. Login to your shop as the shop owner and add a staff member with only "Apps" permission. {F587389}
2. Install flow app: (https://apps.shopify.com/flow)
3. Login with the new user you added and navigate to https://[Your-Shop].myshopify.com/admin/apps/flow/connectors {F587390}
4. Click and connect Google Sheets, Trello and Asana.
5. With the user you added go to https://[Your-Shop].myshopify.com/admin/apps/flow/connectors, click Google Sheets and you will be redirected to: {F587391} Jorge Perez Hilton is my personal Google Account, I link it to the store to create this report. You can verify this by sending me an email to ███████.
6. Grab the URL you are visiting. It will look like https://flow-connectors.shopifycloud.com/gsheet/connect?shop_domain=victim-store-mariogh.myshopify.com&shop_id=10361503766&timestamp=[TIMESTAMP]&path_hmac=[PATH_HMAC].
7. Login with the shop owner and remove the user you added
8. You can now use the links you saved to modify connectors settings for 60 minutes even if you are not a Staff member anymore. To reset the timestamp, go to the link you grabbed before the 60 minutes time-frame ends and disconnect the Google Account by clicking Disconnect. You will see now something like: {F587394}
9. Now, click on Connect and use any Google Account. The account will successfully connect, a new timestamp and a new path_hmac will be generated, and they will give you unauthorized access to Flow connectors for an extra 60 mins.
10. Save the updated URL and repeat the step 8 and step 9 every ~45 min. This can be done manually or by automating the browser actions.

I tried to login with the Admin account, Disconnect and Reconnect a new Google Account, thinking that after a new timestamp and a new path_hmac is generated, the hacker's URL and path_hmac will be "blocked" but it doesn't work this way.

When the Admin generates a new timestamp and a new path_hmac, is like "both URL's are valid to get access". The hacker's (which is a removed staff member) URL still allows him to get unauthorized access to Flow app connections and to refresh the timestamp and path_hmac again and again.

Impact

Through this vulnerability a removed staff member will be able to modify google spread sheet, trello and asana connections to connect his own accounts so that workflow actions regarding the connections go to his accounts and therefore he can still access the shop data.